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MEMORANDUM FOR: Director of Security 


FROM : Clifford Db. May, Jr. 
Director of Data Processing ~  25xX1 
SUBJECT — : Computerized Database - Areas Approved f>= 
Storage of Collateral and Scr Material] | 
REFERENCES : a. Memo to D/ODP fm D/OS atd 27 dan. 77, 


same subject. : 
b. Memo to D/OS Em D/ODP dtd 25 Feb. 77, 
same subject. 


i. Eacceocof previous memorandum (reference b.) stated 
that June as the earliest date that ODP would nave 
personnel available to work on your reguest. However, an 
analyst from B Division of Applications is now available to 
begin work on this project. 
Division, has contacted o£ the 
Security Center to begin a preliminary study of 
ments. 


: _I25X1A 
Specia 25X1A 


your xequire- 


7 Ce analyzing the requirements of the proposed 
Storage Facilities system we have concluded that we could 
readily implement it using ODP'’s central computers. © However, 
a significant resource comaitment is required to collect the 
necessary data and enter it into the data base. We have pre- 
pared an analysis of the data collection and preparation tasks 
and recommended procedures to obtain the data necessary Lor 
the system. These are contained in the attached study. 


3. | _pecause there is a significant resource commit- 
quire 


ment re of Security, ODP, and other Agency components, 
I recommend that coordinate the review of this 


study with those people identified in paragranon 1. of the 
attachment. Before you and I approve ODP's continuing with 
the system development, we should be certain that we agree 
with the findings and recommendations of the attached study. 
TE you concur with the study's rocommendations and want ODP 

to continue work on the schedule provided in the study, please 
sign below. 
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4. [_]has been assignea_xresponsibility 
for this project and may be reached on ext. iz you 25X1A 


25X1A 


ox your staff have any questions concerning-this » ect, 


Att: a/s 


CONCUR: 

Director of Sacurity Date 
C/BD/ODP 
C/AS/ODP 


OH UHI ALT TF 


4 +n 
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SVORAGE FACILITIES para BASE 


(STORFAC) STUDY REPORT 


References: a) Memo fr[C—C*d’SCC<D ODP, ata 16 Nov 77, 25X1A. 
. subject: Requirements Def for 25X14 
Storage Facility Data pase| | 


(2) Memo fr Chief, Compartmented Information 
Branch, DD/P&N/OS, dtd 15 Jan 77, subject: 


Top Level Re nts for Storage Facility 5X1 
Data Base : 


25X11. l. [ _ Agency personnel who have an interest in the 
Storage Facilities Data Base Concept presented in References 


1 and 2, met during the month of December 1977, The following 


inidividuals were present: 


25X1A ~ C/CIB/SSC/OS 
- ISB/PSD/OS 

- ODSE Security Staff 
- OD&E Security Staff 
~ OL Security Staff 
~ C/BD/ODP 
- CD/ODP 
~ C/SMS/DDS&T 
- NFAC Security Staff 
= CSD/CC 
~ C/ISSG/0s 


the references had been studied prior to the meeting. ?he 
data base concept. was thoroughly discussed. The final outcome 
of the meeting was a general concurrence that such a eySeen 
is needed, general agreement on the types of data which shoulda 


be collected and maintained, and satisfaction with the formats 


Approved For Release 2002/05/07 : CIA- RDP96B01172R000900020005- te 


25X1 


25X1 


and Apprpved Fer Belesse:2002/05/93 : CIA-RDROSBOMZAANMORRONBIDI Zed. The data 
elements which would be neaded to support the system are listed 
in Reference akg Report formats are detailed in Reference 2. 

2s | |e general consensus was that a system was 
needed to inventory and monitor secure storage facilities. 
It was questioned, however, whether the development should 
proceed at this time, since the Agency is currently Seerouni Ag 
other studies related to industrial security practices. It 
was decided that ODP shoula expend sufficient effort to investi- 
gate the following: 

° Where is all the data which is needed for data 
base generation currently located? 
How can this information be gathered and reduced 
to machine seadae format? 
® What input media should be used (cards, CAMENEC, 
etc)? 

© What are the STORFAC development costs? 
How, Long will it take to develop such a system? 
The paragraphs which follow address these questions and con- 
tain the findings of this short study effort. 


as az Data which is needed to generate a Storage 


Facilities file is stored in several offices at various loca- 


tions. Some of the data sources will be relatively ecasy 


ar Ok ee el Ce Oe 
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to research. Some of the data is stored in voluminous 
pease and will require considerable effort and aie eoaues. 
familiarity in order to extract the required information. | 
The primary offices which currently maintain most of the 
required information are: 
- Office of Security (0S) 
- Special Security Center (SSC) - 
7 Information Systems Security Group (rss) 
- Physical Security Division (PSD) | 
- Industrial Security Branch (ISB) —< 
-~ Overseas Security Branch (OSSB) 


- Domestic Security Branch (DSB) 


“Technical Security Division (PSD) 
~ Office of Logistics (OL), Security Staff 
- Office of Communications (OC) 


25X1A 


- Communications Security Division (CSD) 

ef [ 
Additional data sources may be identified as the development 
effort progresses. 

4[ _ finformation on approximately 1,200 active storage | 

locations is maintained in SSC. This information is logged 
and maintained on manual records (5 x 7 index cards). Each 
card contains data for one location. Data values on the 
index cards are labeled and, therefore, would be relatively 


easy to extract. The following information is normally 


Saas ee 
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Facility Name 

“Activity Indicator 

Facility Location 

Cover 

SPECLE Number (assigned by SSC) 

Agency Interest’ 

Security Officer w/telephone number 
Alternate Security Office w/telephone number 
Responsible Agency, Component, Division, Contract Team 
Type of Operation 7 fax e4 . 
Facility Clearance Level 
Accreditation Date 
Special Activities 
Associated SCI Projects 
Comments 


oo go o¢00UCWUCUCOUCOOUUCUCOOUUCUOUCOUUUCUCOlUO8 


25X1 5.[___ |rhe OL Security Staff maintains approximately 
1,900 contract folders. About 600 of these folders are main- 
tained for active contracts/contractors. The folders contain 
all the information concerning the contract that a vendor has 
with.the Agency. In addition, the folder has information 
regarding the contractor facility in which classified informa-~ 
tion is stored and/or produced. These folders are for facili- 
ties which may or may not be the same as those facility index 
cards maintained by SSC. Detailed examination of these folders 
would normally yield the following data items: 

Facility. Name 

Facility Location 

Clearance Level. 

Sterility Code 

Security Officer w/telephone number 

Alternate Security Officer w/telephone number 


Security Survey Date(s) 
Component /Division/feam Responsible for the Facility 


oOo 89 0 600 «0 


Extyaction of the Gata from the OL Security Staff contract 


pi . Tht 
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25X1 


25X1 


25X1A 


folders would be fairly difficult. This ' ald be true even if 
- Approved RogRelease 2002/05/07 :-CIA-RDP96B0 t4?2R000900020005-7 

the researcher had a limited familiarity with the contents of 
the folder. This is primarily due to the guantity of data 


stored for a particular contract. 


6. [ The OS/PSD maintains folders on approximately 


[ _Jactive stations located around the world. Information for 


most of the facilities (stations) maintained by PSD is also 


located on the 5 x 7 index cards kept by SSC. In addition to. 


‘data which describes and locates a station, the folders 


identify storage type, cover and type of operation. Also, 


they specify the historical security survey and security audit 


acarer —em.. 


dates which are required for development of STORFAC. These 


folders contain a considerable volume of data and would require 


some degree of familiarity with the contents in order to re- 
search and retrieve the necessary historical information. 

Fs [ | mhe oc, cSp and[_____Jofficersmaintain data 
for installations on which a COMSEC or TEMPEST survey is to 
be or has been conducted. Information on COMSEC and TEMPEST 
surveys is maintained and readily accessible in CSD and[~__] 
on chronological lists which identify the facility ana specify 
the latest survey dates. - 

, Bs | _os/tss¢ maintains a data file which contains 
records on approximately [| |computer facilities. These 
computer areas are primarily located at contractor facilities. 


Information in this data file consists of the following: 
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Facility Namo ¢ ° 

Pacility Location 

Clearance Level - 

Responsible Component/Division/etc. 

Date of latest computer Facility Inspection 
Identification of the types of Computing Equipment 
w/vendor 


ooo 80 6 8 


This data is processed periodically to produce tabular reports 


in several different sequences (Location, Facility Name, etc.). 


ft would be relatively easy to research and extract data for 


' inclusion in the STORFAC data base. 


oe | ese maintains information concerning the 


dates on which an ACM survey was conducted at a specific facility. 
This information is readily available for extraction and 
inclusion in the STORPAC. data base. 

to: | __}ene primary problem which must be solved in 
order to develop the STORFAC data base is how to collect, 
edit, collate, and enter the information which is available 
at the various sources. A procedure must. be developed which 
will either (1) allow all available data to be collected, 
eetated and edited for each unique facility prior to: intro- 
duction to the data base; or (2) allow for incremental develop- 
ment. After considering both approaches, it is suggested 
that the second approach be considered for the development. 
effort. An incremental approach would allow for development 
of a partial data base which would contain partially completa 
records. Subsequent cperations would Supply additional facili- 


ties not currently included in the SSC files and provide the 
4 q 


6 
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25X1 


necessary infor -tion which would -.make th _oartially conpleted 
a Approved FagRelease'2002/05/07 : CIA-RDP96B01'49%R000900020005-7 
records complete. Figure 1, pages 1 through 7 is a flow 
diagram of the suggested approach. 

Ba i [ pry attempt to assemble all the necessary infor~ 


mation prior to data base generation would reguire a signifi- 


cant redundant effort to code information at the various data 


-source locations. In addition, it would place a tremendous 


burden upon SSC to collate all the data for a unigue facility 


prior to its introduction to the data base. 


7 


Pe a su ye | 
f fo 


3 Fis ihe as Bae aA : 
Approved For Releasé-2002/05/07 : ‘CIA-RDP96B01172R000900020005-7 


NEVE DEAR ICE EYE 


i proved Forel se 2002/05/07 : CIA-RDP96B011725%000900020005-7 


TRANS 
CAMEXEC 
MENU 


FACILITIES! 


aaah 


STORFAC 


DATA 


[ Bese oF ‘ 
IN(TIAL 1200 | 


STOR. FACILITIES 


BASE 


a 
“—ENDICES 
Te 


FIGURE 1. PIGE ob SOt. 7 os. 
Approved For Release 2002/05/07 ; GIA-ROPI6BOt17 2RO00900020005-7 
ET thee EEL ALL 


ZY : CIA-RDP96 


“ORMS IN 
MENU FORMAT 


7 ov OF - 
Approved. a f 20 
(2) pproved Fornmaaleaser 2092/8 


STOR. FACILITIES 


WW 
OL-RESEARCH, 
CONTRACT ° 

: WOLDERS 


ADD DATA 
p/TO EXISTING 
TAC FORM 


COMPLETE \ 


A BLANK REPORE— 
FORM 


re ree 


PIGULE pbproved Mor ReleaSe! 2002/05/07°:;C1A-RDP96B04172R000900020005-7 


PTS On, AN Ses 
3) pA peNee Fe emenne 200700 ree 5-7 


PARTIALLY COMPLETE ee 


"RK ie L 


ee en. 


ADD DATA 
TO EXISTING 
FAC FORM 


COMPLETE \ 
A BLANK REPORR ___NO 


FORM 


7 


Sm ne pn ce 


er re Aer rene to es nce 


PIGURE J. PAGE 3 of 7 


ee an Sr er | 
Cle “et , A 
gos. cet Uae ae eemeee ee | 
a ee Se 


Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020005-7 


a nl, 


(2) roproves ef gdess 200z/Ebre | 1 CIA-RDP96B01 Gatco (05-7 


ities & arid 
ps a Forms 


complete foNne 
eon cl: ps \J 


me 


TSD - 
Research 
Records, 


VEN 
>/ to existing - 


FAC uy 


er Ce J ne _| 


Pagure 1 Page 4 of 7 al Ga te a Soran | 
NSNPU 8S Eo tee its 


Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020005-7 


a Ye a IR MEET I ee OE aN Le Ie Oe eI EE OS RN ee EI ON OE ae rae Te 


©) 


Approved Fplypeleasé 2aonibbign CIA- ‘ROPEGRS} 5%95R}90900020)05-7 
pp 


RepOre 


00 STOR fac Lat 
ties & addtitioral 
complexé forms 


i 


ISSG - 
Research, 
Records 


Complete 
a blank 
report 


Add data 
to existin 


FAC form 


Figure 1 Page “SOE -7 


Approved For Release odabitisio7 : ‘ "CIA-ROPS6B011 172R000900020005-7 


Repor 


1200 STOR facility | 
Forms 


+ new FAC_f: or OL, 


IssG, ¥S, TSR | WA 


oc - 
Research 
Records 


Complete 
a blank 
report 
form 


No Yes | Moicis pata 
4+ <FAC on a piYto existing 
t FAC form / 


} 


Pique APPTOVN ar Beye 7onaiti?; Cia ROPEEBOTI7AROONHONN200067 


ve oh play Pe alia Facies ee aera a 
ee DUG Lies N as A 


ease 20027 
Pacility 
Forms 


ae, 
New 


: CIA-RDP96B01179R000900020005-7 


/Ada HRN 
& SPECLE 


. Number 


Comprete\, 
nenu ge or} on 


ends ox} 


TRANS 


DATA 


(oe 4 
Current List 
of Storage 

Facilitias.s 


He 


som reyey et 
ae eer ere 


F igure Approved For Réledse 2002165107: > CIA-RDP96BO1172R000900020005-7 


25X1 


25X1 


aa Release, 2002IR0Z 4 CIBPEPERNIIZROPPNON TG begin 
in the SSC of the Office of Security. Data from each of the 
1,200 index cards would be examined. Data ee required in 
the STORFAC data base which are available in SSC would be 
entered on a Delta Data terminal using a CAMEXEC menu. Figure | 
2 is a copy of the menu which identifies those data items 
input by SSC. Edit routines would be invoked, where Beoiieabee, 
to ensues that the data entered confoxmed to acceptable formats, 
xanges and values prescribed by SSC. After the data passes 
the applicable edits, it will be stored ina transaction disk 
file. Periodically (perhaps once or twice a week), the trans- 
action data would be batched into a job stream which would 
invoke the File Maintenance (FM) module of NIPS. This trans- 
action information would be used to seeped WIESE time} or 
ada to the STORFAC Gata base. 

13. [ fatter each FM process, SSC would be provided 
with an audit trail report wiih would consist of a formatted 
dump of the content of each STORFAC facility record which was 
added to the file or changed in any way during the FM run. 

This activity would continue until data from all 1,200 index 
cards had been extracted and entered into the file. At ens 


point in time, a partially complete STORFAC data base would 


be available for processing by SSC. However, this file would 


only contain partially completed data records. The other 


information needed to wake each facility record complete re~- 


ides in the other offices identified in paragraph 1 of this 


S 


yeport. 


L5 
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| ment effort, the data resieang in the STORFAC data base would 

be .extracted, sorted and processed to produce a master report 
Similar in appearance to the CAMEXEC menu used for data intro- 
duction. The sequence of this report would be in £acility 
name order. Only data for one facility would appear on each 
printed page of the report. At the same ree one line per 
facility cross index listings would be produced to assist 
the other offices who will be contributing data in their | 
facility research and identification activities. The cross 
indices could be provided in facility location by State, 
SPECLE Number, etc. orders, as considered necessary for 
identification purposes. The master report format would con- 
tain all of the known (previously entered by SSC) data together 
with sufficiently labeled space for that information not 
currently in the data base. | 

25x11 “LBs [a quantity of blank forms similar to the 
CAMEXEC menu vould be produced for use hy the offices other 
than SSC, to enter data for facilities not currently resident 
in the STORFAC data base. These forms would have space for 
all the required data fields with labels for data entry. 

25X1 16. | | tne master report, cross index reports and 

: a Supply of blank menu forms would then be forwarded to the 


OL Security Staff for their inputs. 


17 2 
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25x1° ae si | oved rach of the 600 folders x active contracts 
aa . Ap Release 2002/05/07 : CIA-RDP96B0 42R000900020005-7 
—- * must be researched in OL. f the foldex is for a facility 
already in the STORFAC data base, additional bens of inforrma- 
tion (dates, etc.) must be extracted and entered in the appro- 
priate space on the partially cenuiets nese report page for 
that facility. If the folder is for a facility not currently 
in the STORFAC data base, one of the blank forms must be com- 
pleted. All applicable data in the folder must be extracted 
and entered. Figure 3 identifies those data values which 
would be supplied by the OL Security Staff folder research 
| ereave: | 
25X1 LO: [|] When all 600 contract folders have been 
| researched, the partially completed forms, the blank wee 
and the cross index listings will be forwarded to Physical 
Security. The records in PSD would be researched, data ex- 
tracted and entered on the forms in ce same manner as the 
process accomplished in OL. (Figure 4 identifies those data 
values which would be supplied by ae PSD folder research 
effort.) ‘When all PS facility records have been exhausted, 
the forms and index reports will be forwarded to TSD whexe the 
process is repeated (easony ACM dates fox @etevene STORPAC 
records, create new forms for previously not identified facili- 


ties.). When the TSD activity has been completed, the entire 


package will be passed to ISSG for their data extraction process. 


When the ISSG extraction effort is finished, the package is 
18 
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is repeated. When complete, C will return the entire package 
to SSC. (Figure 5 identifies those data values which wouta be 
supplied by TSD; Figure 6 identifies those data values supplied 
by ISSG; and Figure 7 identifies the data values supplied by 
oc/csp and[_ 

Lo. |__| Upon receipt of the package from OC, the final - 
stage of incremental development can begin. Each facility form 
must be examined to determine if it is a new Petey oe Sae 
of the original 1,200 SSC Hecoxds} or if it is one of the 
original SSC facilities. If it is a form for a new facility, 
SSC must determine its SPECLE Number and assign a machine 
reference number (MRN). Since the MRN is the record control 
element for STORFAC, care must be exercised to ensure that 
this MRN is unique from all others. When these two data 
fields have been completed, the information can ba entered via. 
the CAMEXEC menu and transactions created and stored on the 
transaction file. 

20. [| If the form is for one of the Original 1,200 
facilities, the data added by OL, PSD, ISSG, TSD, and OC would 
be entered via the CAMEXEC menu and stored with the Ceausace ead 


produced in the previous step. When all information has been 


entered, the transaction data would be batched into an FM Job 


stream and the STORFAC file updated. At this point, SSC shoxzld 
be in control of a complete Storage Facilities Data Base. It 


is suggested that Master Format. Reports be produced for each 


21 
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‘new Facilities identified and errors found in tha data base, 


blank forms similar to-the CAMEXEC menu can be used to forward 


new or changing information to SSC for inclusion in the data 


base. 


21. | |e previous paragraphs briefly describe a 
suggested process which could be used to incrementally develop 
the STORFAC data base. The pages which follow estimate the 
costs for this effort. Costs are identified for Agency re- 
search and entry effort in working days, software development 
in working days and machine costs in terms of computer eeage 
and terminal hook-up costs. 

22. [| _|ttre cost for the ongoing File Maintenance 
activities which will be required to keep STORPAC current are 
difficult to determine. It is estimated that the data base 
would normally be pane On a weekly basis. This process 
woulda be required to enter data for new facilities and update 
information on existing facilities. In addition, it is assumed 
that there would be approximately 2 report production runs 
per week. Each File Maintenance run will require approximately 
1 minute CPU time at a cost of $22 per run. Each ae 
duction run will require approximately -5 minute CPU time at 
a cost of $ll per run. Computer usage costs will be billed to 
ope. The cost for data extraction and terminal entry will 


@epend upon the amount of. activity associated with introduction 
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performed by the various teams and offices. Terminal hook-up 
time for entry of a new facility will be in the range of DTG 
LO minutes. Hook-up time for entering new data on an existing 
facility will depend upon the amount of data being added. 2s. 
Should not exceed more than 5 minutes per facility. | 
23. |__| the pages which follow provide an estimate for 
the various costs associated with STORFAC development. Figure 
8 presents the es timate for programmer effort associated with 
software development which would be charged to the opp budget. 
Figure 9 provides an estimate of the machine costs for software 
and data base development activities which would be charged to 
the ODP budget. Figure 10 is an estimate of the number of 
work days which would be required to extract and enter the 
data via a terminal using a CAMEXEC menu. Figure ll isa 
schedure for STORFAC development in terms of calendar weeks 


per task. 
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Software Development Cost Estimates 


CAMEXEC MENU W/EDITS De AeeR days 
NIPS FILE ANALYSIS & DESIGN 100O" 8 
PILE MAINTENANCE LOGIC — 6B 8 8 
(Design, Code, Test) 
SSC DESIGNED REPORTS (6) a5 os 
AUDIT TRAIL REPORT i 2" i 
DUPLICATION OF CAMEXEC MENU REPORT 2” " 
CROSS INDEX REPORT 1" " 
FILE GENERATION & TEST 5” " 
NIPS SOFTWARE DOCUMENTATION i0 "8 
USER TRAINING & MONITORING 5 3 " 
COVERSION TABLES 2" " 
TOTAL - ; 69 work days 


Note: This translates into approximately $10,800 
@ $600 per work week. 


(18 wk x $600 = $10,800) 


Figure &. Pregrammer Software Development Cost Estimates 
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MACHINE COST ES SPIMATES 


SOFTWARE DEVELOPMENT COMPUTER cost $L,300 
(approx. 1 hour CPU time) 


| SOFTWARE DEVELOPMENT TERMINAL HOOK-UP Cost $2,400 
(approx. 200 hours @ $12 hour) 


COMPUTER COST FOR PILE GENERATION & $s 650 
REPORT PRODUCTION PU INCREMENTAL 
DEVELOPMENT 

(approx. .5 hour CPU came) 


TERMINAL HOOK-UP TIME FOR SSC DATA ENTRY $3,840 
DURING INCREMENTAL DEVELOPMENT 

(75 facilities per day = 320 

hours at $12 per hook-up hour) 


TOTAL MACHINE Cost $8,190 


Figure 9. Machine Cost Estimates 


a © Rededved Ror Ralease: 7: CIA-RDP96BG4472R000900020005-7 © 
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TER MS OF WORKING DAYS 


SSC ORIGINAL DATA EXTRACTION & 20-25 person work days 
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TOTAL 110-155 person work days 


Note: If records must be researched in other offices, the 
data extraction work day costs must be increased 
-proportionately. 


Figure 10. Data Extraction Cost Estimates 
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